[jekyll] Fix bundle install permission error for non-root user

[Michael Schoen (Foconis) (michaelschoen-foconis)]

Description

Running bundle install as the non-root vscode user inside the Jekyll dev container fails with:

Bundler::PermissionError There was an error while trying to write to
`/usr/local/bundle/cache/<gem>.gem`. It is likely that you need to
grant write permissions for that path.

Root cause

The Ruby base image correctly sets up GEM_HOME (/usr/local/bundle) as 1777 (world-writable, sticky bit) while it is still empty:

ENV GEM_HOME /usr/local/bundle
RUN mkdir -p "$GEM_HOME" && chmod 1777 "$GEM_HOME"

The Jekyll Dockerfile then runs several gem install commands as root (gem update --system, gem install sass-embedded ..., gem install bundler jekyll github-pages). These populate /usr/local/bundle with new subdirectories (cache/, gems/, bin/, specifications/, extensions/, ...), each created with root's default 755 permissions. The 1777 on the top-level directory doesn't propagate to these newly created subdirectories, so vscode ends up unable to write into any of them — exactly where bundle install needs to write.

Why this used to work

A fix for this already existed, but it was scoped to the old RVM-based Ruby layout:

RUN chown -R "vscode:rvm" "/usr/local/rvm/" \
    && chmod -R g+r+w "/usr/local/rvm/" \
    && find "/usr/local/rvm/" -type d | xargs -n 1 chmod g+s

When the Ruby base image moved off RVM to ruby-build/rbenv (#1957, devcontainers/features#1654), this block started failing the build (chown: invalid group: 'vscode:rvm'), and was removed entirely in #1964. That removal was correct for the now-nonexistent rvm group/path, but it also happened to be the only thing keeping /usr/local/bundle group-writable after the gem install steps above — nobody re-applied an equivalent fix for the new layout, since the PR's scope was fixing the broken build, not preserving unrelated side effects of the removed block.

Fix

/usr/local/rubies (the current Ruby install location) already handles this correctly: root:ruby with 2775 (setgid + group-writable), and vscode is a member of the ruby group. This PR applies the same pattern to /usr/local/bundle:

RUN chgrp -R ruby "/usr/local/bundle" \
    && chmod -R g+rwX "/usr/local/bundle" \
    && find "/usr/local/bundle" -type d | xargs -n 1 chmod g+s

Bumped manifest.json version 2.4.1 → 2.4.2.

Validation

Built the image locally from this branch (docker build --build-arg VARIANT=3.4-bookworm ...) and tested against a real-world Gemfile/Gemfile.lock (Jekyll + AsciiDoc + PDF toolchain, 59 gems incl. native extensions like nokogiri, google-protobuf, sass-embedded, ffi):

• Without this fix: bundle install as vscode fails immediately with Bundler::PermissionError on the very first gem it tries to cache.
• With this fix: bundle install as vscode completes ("Bundle complete! 5 Gemfile dependencies, 59 gems now installed."), and a subsequent bundle exec jekyll build succeeds (exit 0).

Type of change

• Bug fix (non-breaking change which fixes an issue)

[Copilot]

🟡 Changes recommended

Add regression coverage and synchronize the README version.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes non-root bundle install failures in the Jekyll image and bumps the patch version.

Changes:

• Makes /usr/local/bundle writable by the ruby group with setgid permissions.
• Updates the manifest version from 2.4.1 to 2.4.2.

File summaries

File	Changes and review findings
src/jekyll/.devcontainer/Dockerfile	Fixes gem directory permissions. Moderate (2 votes): Add regression coverage for non-root bundle install.
src/jekyll/manifest.json	Bumps the image patch version. Nit (3 votes): Update the README version reference to 2.4.2.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Michael Schoen (Foconis) (michaelschoen-foconis)]

@microsoft-github-policy-service agree